HISD employees, others affected by medical records hack

Current and former employees of Houston ISD are among those nationally whose personal medical information may have been accessed in a security breach involving an outside vendor.

HISD posted on item on its website Tuesday telling employees that they should have received letters from Medical Informatics Engineering if they were affected. MIE, the medical records company that was hacked, works with Concentra, which operates the Houston Independent School District’s two on-site health clinics.

The district said a “significant number of current and former HISD employees and their dependents” were affected. The exposed records may have included various data, including lab results, medical conditions, Social Security numbers, usernames and passwords, dates of birth, and contact information, according to HISD.

HISD said district officials were “reviewing which (other) outside vendors have employee information, how to best limit the amount of personal information necessary, and ensure it is as secure as possible.”

MIE said in a notice on its website that the company noticed “suspicious activity” on a server on May 26 and reported it to law enforcement. The company said it started notifying its clients June 2 and mailing letters to affected individuals July 17.